From 2fda8fcef0f3c321fb03953b8ecc424a2bad4476 Mon Sep 17 00:00:00 2001 From: Jan Engelhardt Date: Thu, 24 Jan 2013 09:37:55 +0000 Subject: extensions: S/DNPT: add missing save function Jean-Michel DILLY reports that `ip6tables -S` exits with Target `DNPT' is missing save function when a DNPT rule is invoked. Fix this omission. References: http://marc.info/?l=netfilter&m=135904831220440&w=2 Signed-off-by: Jan Engelhardt Signed-off-by: Pablo Neira Ayuso --- extensions/libip6t_DNPT.c | 19 +++++++++++++++++++ extensions/libip6t_SNPT.c | 19 +++++++++++++++++++ 2 files changed, 38 insertions(+) diff --git a/extensions/libip6t_DNPT.c b/extensions/libip6t_DNPT.c index 7439816c..703adf60 100644 --- a/extensions/libip6t_DNPT.c +++ b/extensions/libip6t_DNPT.c @@ -1,4 +1,5 @@ #include +#include #include #include #include @@ -53,6 +54,23 @@ static void DNPT_print(const void *ip, const struct xt_entry_target *target, npt->dst_pfx_len); } +static void DNPT_save(const void *ip, const struct xt_entry_target *target) +{ + static const struct in6_addr zero_addr; + const struct ip6t_npt_tginfo *info = (const void *)target->data; + + if (memcmp(&info->src_pfx.in6, &zero_addr, sizeof(zero_addr)) != 0 || + info->src_pfx_len != 0) + printf("--src-pfx %s/%u ", + xtables_ip6addr_to_numeric(&info->src_pfx.in6), + info->src_pfx_len); + if (memcmp(&info->dst_pfx.in6, &zero_addr, sizeof(zero_addr)) != 0 || + info->dst_pfx_len != 0) + printf("--dst-pfx %s/%u ", + xtables_ip6addr_to_numeric(&info->dst_pfx.in6), + info->dst_pfx_len); +} + static struct xtables_target snpt_tg_reg = { .name = "DNPT", .version = XTABLES_VERSION, @@ -62,6 +80,7 @@ static struct xtables_target snpt_tg_reg = { .help = DNPT_help, .x6_parse = DNPT_parse, .print = DNPT_print, + .save = DNPT_save, .x6_options = DNPT_options, }; diff --git a/extensions/libip6t_SNPT.c b/extensions/libip6t_SNPT.c index 26a86c56..7ed80b20 100644 --- a/extensions/libip6t_SNPT.c +++ b/extensions/libip6t_SNPT.c @@ -1,4 +1,5 @@ #include +#include #include #include #include @@ -53,6 +54,23 @@ static void SNPT_print(const void *ip, const struct xt_entry_target *target, npt->dst_pfx_len); } +static void SNPT_save(const void *ip, const struct xt_entry_target *target) +{ + static const struct in6_addr zero_addr; + const struct ip6t_npt_tginfo *info = (const void *)target->data; + + if (memcmp(&info->src_pfx.in6, &zero_addr, sizeof(zero_addr)) != 0 || + info->src_pfx_len != 0) + printf("--src-pfx %s/%u ", + xtables_ip6addr_to_numeric(&info->src_pfx.in6), + info->src_pfx_len); + if (memcmp(&info->dst_pfx.in6, &zero_addr, sizeof(zero_addr)) != 0 || + info->dst_pfx_len != 0) + printf("--dst-pfx %s/%u ", + xtables_ip6addr_to_numeric(&info->dst_pfx.in6), + info->dst_pfx_len); +} + static struct xtables_target snpt_tg_reg = { .name = "SNPT", .version = XTABLES_VERSION, @@ -62,6 +80,7 @@ static struct xtables_target snpt_tg_reg = { .help = SNPT_help, .x6_parse = SNPT_parse, .print = SNPT_print, + .save = SNPT_save, .x6_options = SNPT_options, }; -- cgit v1.2.3 From 166f20a3665a28e0f5fcedd0914c8e7d41521428 Mon Sep 17 00:00:00 2001 From: Pablo Neira Ayuso Date: Mon, 7 Jan 2013 21:34:39 +0100 Subject: doc: document nat table for IPv6 Based on the IPv4 description. Signed-off-by: Pablo Neira Ayuso --- iptables/ip6tables.8.in | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/iptables/ip6tables.8.in b/iptables/ip6tables.8.in index 58b7bfc7..24c6f661 100644 --- a/iptables/ip6tables.8.in +++ b/iptables/ip6tables.8.in @@ -106,6 +106,13 @@ the built-in chains \fBINPUT\fP (for packets destined to local sockets), \fBFORWARD\fP (for packets being routed through the box), and \fBOUTPUT\fP (for locally-generated packets). .TP +\fBnat\fP: +This table is consulted when a packet that creates a new +connection is encountered. It consists of three built-ins: \fBPREROUTING\fP +(for altering packets as soon as they come in), \fBOUTPUT\fP +(for altering locally-generated packets before routing), and \fBPOSTROUTING\fP +(for altering packets as they are about to go out). Available since kernel 3.7. +.TP \fBmangle\fP: This table is used for specialized packet alteration. Until kernel 2.4.17 it had two built-in chains: \fBPREROUTING\fP -- cgit v1.2.3